As one of the fastest rowing Michigan website design companies, we work hard to keep up on the latest in cybersecurity advancements. And oh boy, you won’t believe this one. Do you now you have to worry about the sound of your keyboard giving your password away? As hackers become more and more sophisticated researchers continually battle cyberattacks by seeking new ways to strengthen digital defenses. Even as the world adopts increasingly sophisticated security measures, ingenious techniques emerge to exploit vulnerabilities. A recent development from researchers in the UK has once again highlighted the potential weaknesses in password authentication systems. By harnessing the unintentional “side channel” of keyboard acoustic emanations (how your keyboard sounds as you type), these experts have demonstrated how, with the aid of Artificial Intelligence (AI), they can accurately guess passwords with amazing accuracy merely by listening to the sounds of keys being pressed.
The Side Channel Phenomenon
For the most part, we don’t think you have to worry about someone stealing your password if you’re working at Panera on your laptop (like I am right now!). This is Tom Cruise/ Mission Impossible kind of stuff–right now. Although, when it comes to cyber-security, things evolve so quickly it’s good to be prepared, or at least aware.
Enter the world of Side Channel Attacks. Side Channel Attacks have been a subject of interest in cybersecurity for some time. These attacks capitalize on unintentional information leaks that occur during a computer’s operation. Common side channels include noise, heat, and even changes in electromagnetic emissions. Researchers at Durham University, the University of Surrey, and Royal Holloway University of London took a practical approach by investigating keyboard acoustic emanations (the sound your keyboard makes as you type in your password) as a side channel.
Why Keyboard Sounds Matter
The ubiquity of keyboard acoustic emanations makes them a readily available attack vector. Furthermore, many individuals underestimate the potential risks associated with these sounds. While people often hide their screens when entering passwords, they rarely take measures to conceal the noise produced by their keystrokes. Experts warn that this oversight opens the door for potential attackers. For me, however, even as I am typing this, there is so much ambient noise around me from the environment I can’t hear my keyboard making any noise at all. So I am not worried, although I find myself being much more aware.
Real-World Attack Scenarios
So how does this work? How could a hacker listen in to me typing in my password and figure out what I entered? To see if this could actually work, researchers explored real-world attack scenarios. These included eavesdropping on a laptop keyboard using a smartphone’s microphone in the same room and even capturing keyboard sounds during a Zoom call. The results were alarming, as the AI-based algorithm consistently guessed the keys being pressed with very high accuracy, even during a Zoom call.
The Role of Artificial Intelligence
Of course, individual human beings are not capable of doing this electronic wizardry. At the other end of the smartphone and the Zoom call is A.I. As one of the best Michigan website design companies, we are familiar with this A. I., but most people are not. A.I. is at the heart of this novel password-guessing technique with state-of-the-art password guessing tools with names like HashCat and John the Ripper. These types of password guessing tools seem to rely on a couple of things, like concatenation of words, which is defined as a series of interconnected things or events, like your password being password123456, and something called leet speak.
Leet Speak is something we are all probably familiar with, even if you’ve never heard it called Leet Speak before. It’s a style of typing that replaces English letters with similar-looking numbers or symbols. For example, password becomes p4s5w0rd. If you want to try Leet Speak yourself, start off by simply replacing some of your letters or numbers with similar looking characters, like replacing the letter E with the number 3, like in L3Et Speak.
Deep Learning
The specific A.I. on the other end of that smartphone with the microphone and the Zoom call, was something called Deep Learning. This A.I. tool mimics the human brain’s learning process, and was employed to identify which of a keyboard’s 36 keys were being pressed. The algorithm was trained using 25 keystrokes on each key, encompassing different fingers and pressure levels. The resulting sounds were processed extensively, transformed into images, and then fed into a deep learning algorithm designed for image classification.
Remarkable Accuracy
So how well did Ddp Learning work? The researchers actually achieved impressive results, with a top-1 classification accuracy of 95% when using phone-recorded laptop keystrokes. This represents a substantial improvement over classifiers that do not employ language models and ranks as the second-best accuracy in the existing literature. When tested on Zoom-recorded data, the technique still achieved a remarkable 93% accuracy.
Implications for Security
The implications of this research raise concerns about the security of password-based authentication systems. While most individuals (like me on my laptop at Panera) may not face immediate risks from this technique, certain targets, such as high-value individuals or organizations, could be at significant risk. Intelligence agencies or those involved in industrial espionage might find this method appealing. Additionally, the researchers note that a deep learning engine trained on one laptop model could potentially guess passwords on other laptops of the same model, hinting at the potential of such attacks in the future. Moving Beyond Passwords
There are several approaches already created and being refined to address this issue. The complicated one is an A.I. called PassGAN. PassGAN does rely on manual password analysis, but uses something called a Generative Adversarial Network (GAN). What this does is learns autonomously learns the distribution of real passwords from actual password leaks, and to generate high-quality password guesses. What? That is next level stuff.
The easy ways to get around this are just to use a password manager. Google does a great job, we use the free Chrome add on called Last Pass and it works perfectly. You could also try things like passkeys or two-factor authentication.
Conclusion
At the end of the day, this is not so scary of a prospect for the Panera laptop guy, at least not yet! However, the creation of password-guessing techniques based on keyboard acoustic emanations underscores the ever-present need for vigilance in cybersecurity. While not an immediate threat for most, the potential consequences for high-value targets and the commodification of such attacks highlight the importance of continuous innovation in cybersecurity practices. As technology advances, so too must our defenses, and staying ahead of emerging threats remains a paramount concern in our interconnected digital world.
As one of the fastest growing Michigan website design companies that can take care of all of your website design and development, hosting and SEO, check us out at 212 Creative.com. Call us. Let’s begin.
